{"service":"Siteline","description":"AI agent readiness scanner for public websites.","conformance":"level-4","specUrl":"https://github.com/snapsynapse/graceful-boundaries","limits":{"scan":{"endpoint":"/api/scan","method":"GET","limits":[{"type":"ip-rate","maxRequests":10,"windowSeconds":3600,"description":"10 scans per IP per hour."},{"type":"resource-dedup","maxRequests":1,"windowSeconds":86400,"description":"Repeat scans reuse a same-day result for the submitted URL scope when scanner and rubric versions match. An engine version change may regenerate and replace that day's report."}],"note":"Cached results are returned with _rescanBlocked: true. The result is still valid and complete. force/refresh requires operator authentication through x-siteline-bypass-token; unauthorized force returns 403. An authorized refresh can replace the same-day report."},"resultLookup":{"endpoint":"/api/result","method":"GET","limits":[{"type":"ip-rate","maxRequests":60,"windowSeconds":60,"description":"60 lookups per IP per minute."}],"note":"Accepts result IDs (example-com-20260321 or example-com-pricing-a1b2c3d4-20260321) and domains (example.com) in the ?id= parameter."},"resultPage":{"endpoint":"/results/:id","method":"GET","limits":[{"type":"ip-rate","maxRequests":60,"windowSeconds":60,"description":"60 page loads per IP per minute."}],"note":"Server-rendered HTML with OG meta tags. Redirects to the SPA for interactive use."},"ogImage":{"endpoint":"/api/og","method":"GET","limits":[{"type":"ip-rate","maxRequests":30,"windowSeconds":60,"description":"30 image generations per IP per minute."}]},"limitsDiscovery":{"endpoint":"/api/limits","method":"GET","limits":[{"type":"ip-rate","maxRequests":60,"windowSeconds":60,"description":"60 requests per IP per minute."}]},"emailCapture":{"endpoint":"/api/email-capture","method":"POST","limits":[{"type":"ip-rate","maxRequests":12,"windowSeconds":3600,"description":"12 submissions per IP per hour."},{"type":"pdf-cooldown","maxRequests":1,"windowSeconds":60,"description":"1 report email per IP per 60 seconds (for source: pdf-export)."}]}},"ssrfProtection":{"description":"The scan endpoint blocks private, reserved, and internal network addresses using URL validation, DNS validation, connection pinning, and redirect-target checks.","blocked":["Private IPv4 ranges (10.x, 172.16-31.x, 192.168.x)","Loopback and IPv4-mapped loopback (127.x, localhost, ::1, ::ffff:127.x)","Link-local and cloud metadata (169.254.x, metadata.google.internal)","Reserved, documentation, multicast, and unique-local ranges","Internal hostnames (*.internal, *.local)","Non-standard ports (only 80 and 443 allowed)","Unsafe initial or redirect targets that resolve to blocked hosts during DNS validation","DNS rebinding between validation and connection by pinning each request to validated public addresses"],"bodyLimits":{"primaryPageBytes":1000000,"resourceBytes":250000,"description":"Fetched response bodies are bounded before parsing; evidence excerpts remain capped separately."}},"responseHeaders":{"Retry-After":"Seconds to wait before retrying (present on 429 responses).","X-Siteline-Cache":"HIT, KV_HIT, or MISS — indicates whether the result was cached.","X-Siteline-Request-Id":"Unique request identifier for debugging."},"links":{"scanner":"https://siteline.to/","api":"https://siteline.to/api/scan?url=example.com","limits":"https://siteline.to/api/limits","rubric":"Use the MCP server or CLI: siteline rubric"}}